ELEX HelpDeskに認証不要のRCE脆弱性、修正版は未確認
Summary
WordPressプラグインELEX WordPress HelpDesk & Customer Ticketing System 3.3.9以前に、ログイン不要でサーバー上のコードを実行される脆弱性が公表されました。導入の有無と版を調べ、修正版が確認できなければ無効化を検討します。
AI summary
Produced by SecPulse using an external AI model; it may contain mistakes. Check the original description and references below before acting on it.
WordPressプラグインELEX WordPress HelpDesk & Customer Ticketing System 3.3.9以前に、ログイン不要でサーバー上のコードを実行される脆弱性が公表されました。導入の有無と版を調べ、修正版が確認できなければ無効化を検討します。
Affected packages
| Package | Affected → Fixed | |
|---|---|---|
| elextensionsELEX WordPress HelpDesk & Customer Ticketing System |
≤ 3.3.9→ Not listed |
Not listed |
This record does not list fixed versions. Check the article or the vendor advisory in the references for whether and where it is fixed.
Original description The description as published by the source.
The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.3.9 via the 'form (specifically the attacker-controlled ticket_label field inside the url-encoded form string)' parameter parameter. This is due to missing server-side authentication and the absence of a class allowlist on deserialization, with the only guard being a nonce publicly emitted on any page carrying the [wsdesk_support] shortcode. This makes it possible for unauthenticated attackers to execute code on the server. A successful exploit requires a single anonymous GET to any public page carrying the [wsdesk_support] shortcode to harvest the publicly emitted wsdesk_nonce value, after which a single unauthenticated POST completes the attack.
Source: CVE.org (CVE Program・cvelistV5) NVD